CVE-2026-73389 | Critical | 9.8 | 2026-08-19 | Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions. |
CVE-2026-73364 | Critical | 9.8 | 2026-08-19 | Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions. |
CVE-2026-75987 | High | 7.3 | 2026-08-19 | A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/para… |
CVE-2026-74012 | High | 8.8 | 2026-08-18 | Editor PHP Object Injection in TaxoPress <= 3.51.0 versions. |
CVE-2026-73397 | Critical | 9.8 | 2026-08-18 | Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions. |
CVE-2026-73380 | Critical | 9.8 | 2026-08-18 | Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions. |
CVE-2026-73376 | Critical | 9.8 | 2026-08-18 | Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. |
CVE-2026-73366 | Critical | 9.8 | 2026-08-18 | Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions. |
CVE-2026-73341 | Critical | 9.8 | 2026-08-18 | Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. |
CVE-2026-66620 | High | 7.2 | 2026-08-18 | Editor PHP Object Injection in OptionTree <= 2.7.3 versions. |
CVE-2026-59940 | Critical | 9.8 | 2026-08-18 | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attack… |
CVE-2026-32470 | Critical | 9.8 | 2026-08-18 | Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. |
CVE-2026-32465 | High | 8.8 | 2026-08-18 | Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions. |
CVE-2026-16138 | High | 8.0 | 2026-08-17 | In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access… |
CVE-2024-13784 | Critical | 9.8 | 2026-08-16 | The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including… |
CVE-2026-10035 | Medium | 6.6 | 2026-08-16 | The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization o… |
CVE-2026-16099 | High | 8.8 | 2026-08-16 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item fu… |
CVE-2025-7639 | High | 7.1 | 2026-08-14 | The vulnerability, if exploited, could allow an authenticated miscreant
with "DNA Authority - Operator" privilege to tamper with serialized
data, potentially… |
CVE-2026-19826 | High | 7.3 | 2026-08-14 | A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerial… |
CVE-2026-10571 | Medium | 5.7 | 2026-08-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, a… |
CVE-2026-66256 | High | 7.2 | 2026-08-13 | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig.
This issue affects Apache Shindig: all versions.
Users wit… |
CVE-2026-28176 | High | 8.8 | 2026-08-13 | Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions. |
CVE-2026-28149 | Critical | 9.8 | 2026-08-13 | Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. |
CVE-2026-27380 | High | 7.2 | 2026-08-13 | Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions. |
CVE-2026-67579 | High | 7.4 | 2026-08-12 | Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pag… |
CVE-2026-73325 | High | 7.8 | 2026-08-12 | Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a… |
CVE-2026-67587 | High | 8.8 | 2026-08-12 | Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback… |
CVE-2026-67260 | High | 7.3 | 2026-08-12 | Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the… |
CVE-2026-59242 | Medium | 5.4 | 2026-08-12 | Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` with… |
CVE-2026-58076 | High | 8.8 | 2026-08-12 | Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiatin… |
CVE-2026-68756 | Medium | 6.6 | 2026-08-12 | A party with write access to stored session data may affect JFrog Artifactory under specific conditions. |
CVE-2026-18634 | High | 8.4 | 2026-08-11 | An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A… |
CVE-2026-48397 | High | 8.6 | 2026-08-11 | Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current… |
CVE-2026-70321 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-66808 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-66805 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-65815 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. |
CVE-2026-65665 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-65663 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-65658 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-64901 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-63516 | Medium | 6.5 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-63514 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-62912 | Medium | 6.5 | 2026-08-11 | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network. |
CVE-2026-59124 | Critical | 9.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network. |
CVE-2026-35502 | | | 2026-08-11 | Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an escalation of priv… |
CVE-2026-17061 | Critical | 10.0 | 2026-08-11 | A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated re… |
CVE-2026-15555 | High | 8.8 | 2026-08-11 | A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshalle… |
CVE-2026-18948 | Critical | 9.9 | 2026-08-10 | A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' libra… |
CVE-2026-69659 | Medium | 5.5 | 2026-08-09 | Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor… |
CVE-2026-16267 | High | 8.1 | 2026-08-08 | The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing una… |
CVE-2026-68772 | High | 8.0 | 2026-08-07 | ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifa… |
CVE-2026-71560 | Critical | 9.1 | 2026-08-07 | Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing s… |
CVE-2026-71559 | High | 7.5 | 2026-08-07 | Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted da… |
CVE-2026-71558 | Critical | 9.8 | 2026-08-07 | Heap type confusion vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input pa… |
CVE-2026-16258 | Critical | 9.8 | 2026-08-07 | The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP… |
CVE-2026-50515 | Critical | 9.9 | 2026-08-07 | Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network. |
CVE-2026-65581 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. |
CVE-2026-65579 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. |
CVE-2026-65578 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Agora <= 1.9 versions. |
CVE-2026-65577 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions. |
CVE-2026-65576 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. |
CVE-2026-65575 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions. |
CVE-2026-65574 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Abogado <= 1.18 versions. |
CVE-2026-65573 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. |
CVE-2026-65572 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. |
CVE-2026-65571 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. |
CVE-2026-65556 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions. |
CVE-2026-65552 | Critical | 9.8 | 2026-08-06 | Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. |
CVE-2026-65549 | High | 7.2 | 2026-08-06 | Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions. |
CVE-2026-28139 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions. |
CVE-2026-66909 | Critical | 9.8 | 2026-08-06 | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any at… |
CVE-2026-70426 | Critical | 9.0 | 2026-08-05 | In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class f… |
CVE-2026-71294 | High | 7.6 | 2026-08-05 | Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions… |
CVE-2026-71281 | High | 8.8 | 2026-08-05 | Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101)… |
CVE-2026-61484 | Critical | 9.8 | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project… |
CVE-2026-70554 | Critical | 9.8 | 2026-08-04 | MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serial… |
CVE-2026-47623 | High | 8.2 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability mi… |
CVE-2026-69098 | Critical | 9.8 | 2026-08-04 | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiat… |
CVE-2026-18642 | High | 7.8 | 2026-08-03 | Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection.
This issue af… |
CVE-2026-16297 | Medium | 4.1 | 2026-08-03 | The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrat… |
CVE-2025-15672 | High | 8.1 | 2026-08-03 | The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated… |
CVE-2026-3245 | High | 7.5 | 2026-08-03 | A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution. |
CVE-2026-16062 | Medium | 6.6 | 2026-08-02 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event con… |
CVE-2026-68771 | Critical | 9.8 | 2026-07-31 | ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitr… |
CVE-2026-12720 | High | 7.5 | 2026-07-31 | The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, l… |
CVE-2026-11536 | High | 8.5 | 2026-07-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector. |
CVE-2026-15976 | Critical | 9.8 | 2026-07-30 | SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, whe… |
CVE-2026-15969 | Critical | 9.8 | 2026-07-30 | SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command executi… |
CVE-2026-12118 | Critical | 9.8 | 2026-07-30 | IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserializa… |
CVE-2026-57859 | High | 7.5 | 2026-07-30 | e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database wr… |
CVE-2026-1360 | High | 7.5 | 2026-07-30 | The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unse… |
CVE-2026-65883 | Critical | 9.8 | 2026-07-29 | Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection i… |
CVE-2026-58163 | High | 7.5 | 2026-07-29 | Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing.
This issue affects Apache Traffic Server: from 8.0.0… |
CVE-2026-14974 | High | 8.1 | 2026-07-28 | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted… |
CVE-2026-14512 | Critical | 9.8 | 2026-07-28 | IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to byp… |
CVE-2026-66713 | Critical | 9.8 | 2026-07-28 | Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component
in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache… |
CVE-2026-11756 | Critical | 10.0 | 2026-07-28 | A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEX… |
CVE-2026-65617 | High | 8.8 | 2026-07-27 | A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under… |
CVE-2026-63077 | Critical | 9.8 | 2026-07-27 | In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol |